Several flaws were discovered in the browser engine of Thunderbird. If auser were tricked into viewing malicious content, a remote attacker coulduse this to crash Thunderbird or possibly run arbitrary code as the userinvoking the program. (CVE-2010-1211, CVE-2010-1212)

An integer overflow was discovered in how Thunderbird processed CSS values.An attacker could exploit this to crash Thunderbird or possibly runarbitrary code as the user invoking the program. (CVE-2010-2752)

An integer overflow was discovered in how Thunderbird interpreted the XULelement. If a user were tricked into viewing malicious content, a remoteattacker could use this to crash Thunderbird or possibly run arbitrary codeas the user invoking the program. (CVE-2010-2753)

Aki Helin discovered that libpng did not properly handle certain malformedPNG images. If a user were tricked into opening a crafted PNG file, anattacker could cause a denial of service or possibly execute arbitrary codewith the privileges of the user invoking the program. (CVE-2010-1205)

Yosuke Hasegawa discovered that the same-origin check in Thunderbird couldbe bypassed by utilizing the importScripts Web Worker method. If a userwere tricked into viewing malicious content, an attacker could exploit thisto read data from other domains. (CVE-2010-1213)

Chris Evans discovered that Thunderbird did not properly process improperCSS selectors. If a user were tricked into viewing malicious content, anattacker could exploit this to read data from other domains.(CVE-2010-0654)

Soroush Dalili discovered that Thunderbird did not properly handle scripterror output. An attacker could use this to access URL parameters fromother domains. (CVE-2010-2754)

Solution:The problem can be corrected by upgrading your system to thefollowing package versions:

Ubuntu 10.04 LTS: thunderbird 3.0.6+build2+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart Thunderbird to makeall the necessary changes.